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EXAMINER'S ANSWER 



This is in response to the appeal brief filed 01/03/2007 
appealing' from the Office action mailed 05/01/2006. 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest 
is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, 
interferences, or judicial proceedings which will directly 
affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the 
brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after 
final rejection contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the 
brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be 
reviewed on appeal is correct. 



Application/Control Number: 09/916,929 Page 
Art Unit: 2137 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix 
to the brief is correct*. 

(8) Evidence Relied Upon 

20020194212 GRUPE et al. 12-2002 

WO 98/45778 ZUTA 10-1998 

Snavely, Allan; Tullsen, Dean "Symbolic Jobscheduling for a 
Simultaneous Multithreading Processor" Proceedings of ASPLOS IX, 
November 2000. 

(9) Grounds of Rejection 

The following ground (s) of rejection are applicable to the 
appealed claims: 

Claim Rejections - 35 USC §102 

Claims 1-2, 4-7, 8-13, 17-18, 20-24, 25-29, 33-35, 38-40, 
42, and 44 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Grupe, U.S. Patent Application Publication No. 
2002/0194212. 

As per claims 1,17, and 33, the applicant describes a 
method of scanning data comprising the following limitations 
which are met by Grupe: 

a) executing scanning control logic utilizing a central 
processing unit ( [0008] , [0009] ) ; 
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b) identifying a request related to data at the central 
processing unit ( [0008] , [0009] ■) ; 

c) indicating the data to a scanning co-processor coupled 
to the central processing unit so that the data is scanned by 
the scanning co-processor under control of the scanning control 
logic ( [0008] , [0009] ) ; 

d) waiting for results from the scanning co-processor 
( [0008] , [0009] ) ; 

e) executing additional logic utilizing the central 
processing unit while waiting for the results from the scanning 
co-processor ( [0008] , [0009] , [0016] ) ; 

f) initiating an event based on the results from the 
scanning co-processor ([ 0015] ,[ 0017 ]) ; 

g) wherein the scanning co-processor is under the control 
of the central processing unit via the execution of the scanning 
control logic by the central processing unit ( [0008] , [0009] ) ; 

h) wherein it is determined whether the data meets a 
predetermined criteria, where the criteria is based on a type of 
a file associated with the data ([ 0012 ] -, [ 0036] ) ; 

i) wherein the data is sent to the scanning co-processor if 
it 'is determined that the data meets the predetermined criteria 

( [0012] , [0036] ) ; 
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. j) wherein additional data to be scanned by the scanning 
co-processor is queued while waiting for the results from the 
scanning co-processor ([0009]), 

As per claims 2 and 18, the applicant describes the method 
of claims 1 and 17, which are met by Grupe (see above), with the 
following limitation which is also met by Grupe: 

Further comprising processing the data utilizing the 
central processing unit upon the receipt of favorable results 
from the scanning co-processor including a situation where 
malicious code is not detected ([0015], [0030]). 

As per claims 4, 7, 20, and 23, the applicant describes the 
method of .claims 1, 6, 17, and 22, which are met by Grupe (see 
above) , with the following limitation which is also met by 
Grupe: wherein the scanning control logic includes hardware 
([0011]). 

As per claims 5 and 21, the applicant describes the method 
of claims 3 and 20, which are met by Grupe (see above) , with the 
following limitation which is also met by Grupe: wherein the 
scanning control logic is stored, on the scanning co-processor 
[0009]. 

As per claims 6 and 22, the applicant describes the method 
of claims 1 and 17, which are met by Grupe (see above), with the 
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following limitation which is also met by Grupe : wherein the 
scanning control logic includes software [0011] . 

As per claims 8 and 24, the applicant describes the method 
of claims 1 and 17,. which are met by Grupe, with the following 
limitation which is also met by Grupe: wherein the event is 
initiated under the control of the scanning control logic 
( [0010] -[0011] , [0015] - [0016] ) . 

As per claims 9 and 25, the applicant describes the method 
of claims 1 and 17, which are met by Grupe (see above), with the 
following limitation which is also met by Grupe: wherein the 
scanning co-processor performs content scanning [0011]. 

As pfer claims 10 and 26, the applicant describes the method 
of claims 1 and 17, which are met by Grupe' (see above), with the 
following limitation which is also met by Grupe: wherein the 
scanning co-processor performs virus scanning [0011] . 

As per claims 11 and 27, the applicant describes the method 
of claims 1 and 17, which are met by Grupe (see above), with the 
following limitation which is also met by Grupe: wherein the 
scanning co-processor includes memory [0016] . 

•As per claims 12 and 28, the applicant describes the method 
of claims 11 and 27, which are met by Grupe (see above), with 
the following limitation which is also met by Grupe: wherein 
virus signatures are stored in memory ([0011], [0028]). 
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As per claims 13 and 29, the applicant describes the method 
of claims 11 and 27, which are met by Grupe (see above), with 
the following limitation which is also met by Grupe: wherein 
rule sets are stored in memory [0011] . 

As per claims 34 and 35, the claims repeat the limitations 
of claim 1, which is met by Grupe (see above), with the 
following additional limitations which are also met by Grupe: 

j) initiating a security event upon the receipt of 
unfavorable results from the scanning co-processor including a 
situation where malicious code is detected ( [0015] , [0017] ) ; 

k) processing the data utilizing the central processing 
unit upon the receipt of favorable results from the scanning co- 
processor including a situation where malicious code is not 
detected ( [0015] ) . 

As per claim 38, the applicant discloses the method of 
claim 1, which is met by Grupe (see above), with the following 
limitation which is also met by Grupe: wherein the criteria is 
further based on a user ([0036]); 

As per claim 39, the applicant describes the method of 
claim 1, which is met by Grupe (see above), with the following 
limitation which is also met by Grupe: wherein the criteria is 
further based on software logic run by a bios ([0036]). 
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As per claim 40, the applicant describes the method of 
claim 1, which is met by Grupe (see above), with the following 
limitation which is also met by Grupe: wherein the scanning 
control logic is executed automatically [0009], 

As per claim 42, the applicant describes the method of 
claim 1, which is met by Grupe (see above), with the following 
limitation which is also met by Grupe: wherein the scanning 
control logic is executed manually by a user [0028] . 

As per claim 44, the applicant describes the method of 
claim 1, which is met by Grupe (see above), with the following 
limitation which is also met by Grupe: wherein the central 
processing unit aids the scanning co-processor when a large 
amount of data is to be scanned [0016] . 

Claim Rejections - 35 USC § 103 

Claims 3, 19, 36, 41 and 43 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Grupe in view of Zuta, 
International Publication No. WO 98/45778. 

As per claims 3 and 19, the applicant describes the method 
of claims 1 and 17, which are met by Grupe (see above), with the 
following limitation which is met .by Zuta: wherein the central 
processing unit is coupled to the scanning co-processor via a 
bus (Zuta : Fig 2) . 
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Grupe discloses all the limitations of independent claims 1 
and 17. However, Grupe does not disclose that the CPU is 
coupled to the scanning co-processor via a bus. 

Zuta discloses a similar anti-virus scanning system in 
which a supervisor computer (2 of Fig 2) monitors the data 
processed by the CPU of a first computer (11 of Fig 2) and 
intervenes to stop the CPU of the first computer if the 
supervisor computer thinks a virus might be present. Zuta also 
discloses- that the CPU of the first computer and the scanning 
co-processor of the supervisor computer are coupled by a bus (17 
of Fig 2) . - 

It would have been obvious to one of ordinary skill in the 
art at the time the invention was filed to incorporate the ideas 
of Zuta with those of Grupe and add the use of a bus between the 
CPU of the first computer and the scanning co-processor of the 
second computer because a bus is a commonly used method of * 
transmitting data between two units. 

As per claim 36, the applicant describes the method of 
claim 35, which is met by Grupe (see above), with the following 
limitation which is met by Zuta: wherein the scanning 
information is updated via a network periodically (Zuta: Page 
12, 2 nd paragraph) . 
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As per claim 41, the applicant describes the method of 
claim 1, which is met by Grupe (see above), with the following 
limitation which is met by Zuta: wherein the scanning control' 
logic is executed automatically when a computer is booted up 
(Page 24, lines 1-3) . 

As per claim 43, the applicant describes the. method of 
claim 1, which is met by Grupe (see above) , with the following 
limitation which is met by Zuta: wherein the scanning control 
logic is executed using software logic run by a bios (Page 24, 
lines 1-3) . 

Claim 37 is rejected under 35 U.S.C. 103(a) as being 
unpatentable over Grupe in view of Snavely, (Snavely, Allan; 
Tullsen, Dean. Symbiotic Jobscheduling for a Simultaneous 
Multithreading Processor. Published in the Proceedings of 
ASPLOS IX. November 2000). 

As per claim 37, the applicant describes the system of 
claim 35, which is met by Grupe (see above) , with the following 
limitation which is met by Snavely: wherein the additional . logic 
to be executed and the additional data queued to be scanned are 
handled utilizing multi-threading algorithms (Snavely: 
Abstract)'. 
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Grupe discloses all the limitations of independent claim 
35. However, Grupe fails to mention the use of multi-threading 
algorithms. Snavely discloses that • multi-threading algorithms 
are an effective way to "increase . system utilization and speedup 
the execution, of jobs" (Snavely: Abstract) . It would have been 
obvious to one of ordinary skill in the art at the time the 
invention was filed to incorporate the ideas of Snavely with 
those of Grupe and use multi-threading algorithms because multi- 
threading algorithms are an effective way to deal with multi-job 
processing such as with additional logic to be executed or 
additional data queued to be scanned. 

(10) Response to Argument 
Issue #1: 

Rejection of claims 2, 18,. and 34-37 under 35 USC 112, second 
paragraph. 

Appellant argues the rejection of claims 2, 18, and 34-37 under 
the second paragraph of 35 USC 112 is improper. Appellant's 
arguments are persuasive and this rejection has been withdrawn. 

Issue #2 

Rejection of claims 1-2, 4-13, 17-18, 20-29, 33-35, 38-40, 42, 
and 44 under 35 USC 102(e) as being anticipated by Grupe. 
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Groups #1: Claims 1, 4-7, 9-11, 13, 17, 20-23, 25-27, 29, 
33, 40, and 42 

Appellant argues Grupe fails to disclose the claimed technique 
"wherein the scanning co-processor is under the control of the 
central processing unit via the execution of the scanning 
control logic by the central processing unit". Appellant 
specifically argues that Grupe fails to disclose "the scanning 
co-processor is under the control of the central processing 
unit" However, Grupe discloses in paragraph [0009] , 

Embodiments of the invention transfer data to be scanned 
from a source computer to a scanning computer. The 
scanning computer then scans the data and creates a log 
file identifying portions of the data that have 
predetermined characteristics indicating a particular 
specified content, (emphasis added) 

The sending of data from the source computer (i.e. the central 
processing unit) to the scanning computer (i.e. the co- 
processor) is an instruction to scan the data sent because the 
scanning computer scans the data as the next step after 
receiving the data. Since the scanning computer is instructed 
by the source computer to scan the data from source computer it 
is under the control of the source computer. 
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Appellant argues Grupe fails to disclose the claimed technique 
"wherein additional data to be scanned by the scanning . co- 
processor is queued while waiting for the results from the 
scanning co-processor". Appellant specifically argues that 
Grupe fails to disclose "[queuing] addition data to be 
scanned. ..while waiting for the results". However, Grupe discloses 
in paragraph [0034], 

The scanning computer then scans the copied files for 
predetermined characteristics indicative of a banned file 
or a virus. Any files detected containing such 
characteristics are identified and details of these files 
are written to a log file. When all the copied files have 
been scanned the log file is sent back to the main 
computer. 

In. other words, Grupe discloses the files are sent and scanned 
by the scanning computer and once all the files have been 
scanned the log is sent to the source computer. Therefore, the 
files that have yet to be scanned are stored while waiting for 
the results because the results are not sent until all of the 
data has been scanned. 



Group #2: Claims 2 and 18 

Appellant argues Grupe fails to disclose "processing the data 
utilizing the central processing unit upon the receipt of 
favorable results from the scanning co-processor including a 
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situation where malicious code is not detected". Grupe 
discloses in paragraph [0030], 

The backup system then scans (2) the copied data for 
predetermined characteristics which indicate a specific content, 
such as a virus or a worm. The backup system creates a log file 
and writes (3) details of such data to the log file. It then 
sends (4) the log file back to the live system. The live system 
then scans any live data that is indicated in the log file. 

When the live system receives the log file containing a list of 
infected files, any file that is not on the list has favorable 
results. Therefore when the files copied from the live system 
to the backup system are the complete set of files stored on the 
computer (see paragraph [0031]), the files not in the log file 
would be utilized as normal by the live system. 

Group #3: Claims 8 and 24 

Appellant argues Grupe fails to disclose "wherein the event is 
initiated under the control of the scanning control logic". 
However, in paragraphs [0015] and [0016} Grupe discloses a 
computer program product comprising "a computer program operable 
to control a source computer to scan computer' data" (paragraph 
[0015]) and vv a computer program operable to control said source 
computer to transmit at least one further fraction of ,said data 
to at least one further scanning computer" (paragraph [0016] ) . 
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Therefore, Grupe discloses initiating an event (the scanning of 
data) either by scanning the data itself (paragraph [0015]) or 
sending it to a scanning computer (paragraph [0016]) using 
scanning control logic (the computer program) . 

Group #4 Claims 12 and 28 

Appellant argues Grupe fails to disclose "wherein virus 
signatures are stored in the memory". However, in order to make 
any type of comparison in a processor each value involved in 
this comparison must be stored in some type of memory because if 
both values were not stored, one value .would not be' available 
for comparison. Therefore, when comparing the files against 
virus definition profiles, both the file and the definition 
profiles must be held in memory. . 

Group #5 Claims 34 and 35 

Appellant argues Grupe fails to disclose the claimed technique 
"wherein additional data to be scanned by the scanning co- 
processor is queued while waiting for the results from the 
scanning co-processor". Appellant specifically argues that 
Grupe fails to disclose "[queuing] addition data to be 
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scanned. ..while waiting for the results". However , Grupe discloses 
in paragraph [0034], 

The scanning computer then scans the copied files for 
predetermined characteristics indicative of a banned file 
or a virus. Any files detected containing such 
characteristics are identified and details of these files 
are written to a log file. When all the copied files have 
been scanned the log file is sent back to the main 
computer . 

In other words, Grupe discloses the files are sent and scanned 
by the scanning computer and once all the files have been 
scanned the log is sent to the source computer. Therefore, the 
files that have yet to be scanned are stored while waiting for 
the results because the results are not sent until all of the 
data has been scanned. 



Appellant argues Grupe fails to disclose "processing the data 
utilizing the central processing unit upon the receipt of 
favorable results from the scanning co-processor including a 
situation where malicious code is not detected". Grupe 
discloses in paragraph [0030], 

The backup system then scans (2) the copied data for 
predetermined characteristics which indicate a specific content, 
such as a virus or a worm. The backup system creates a log file 
and writes (3) details of such data to the log file. It then 
sends (4) the log file back to the live system. The live system 
then scans any live data that is indicated in the log file. 



When the live system receives the log file containing a list of 
infected files, any file that is not on the list has favorable 
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results. Therefore when the files copied from the live system 
to the backup system are the complete set of files stored on the 
computer (see paragraph [0031]), the files not in the log file 
would be utilized as normal by the live system. 

Group #6 Claim 38 

Appellant argues Grupe fails to disclose, "wherein the criteria 
is further based on a user." In paragraph [0036] Grupe 
discloses, "embodiments of the above invention can be used to 
detect any content of a file that the user specifies". 
Therefore, the content that the user specifies is the criteria 
and since the' user selected these criteria it is based on the 
user. 

Group #7 Claim 39 

Appellant argues Grupe fails to disclose, "wherein the criteria 
is further based on software logic run by a bios." In paragraph 
[0031] Grupe discloses, "The files copied from the source 
computer may be a complete set of files stored on the computer". 
Therefore, when all the files are sent as a criterion for 
scanning, the software logic that is run by a. bios is included 
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with these files and therefore the criteria is based on software 
logic run by a bios. 

Group #8 Claim 44 

Appellant argues Grupe fails to disclose, "wherein the central 
processing unit aids the scanning co-processor when a large 
amount of data is to be scanned." As described in paragraph 
[0016] of Grupe, "By dividing the data to be scanned into 
different fractions and sending each fraction to a different 
scanning computer, a scan can be performed in less time than it 
would take a single scanning computer." Since the source 
computer has "a computer program operable. ..to scan computer 
data", it is a scanning computer. Therefore, when the dividing ', 
as taught in paragraph [0016] is performed the source computer 
would also scan a fraction of the data in order to complete the 
scan during a slack period, such as overnight. : 

Issue #3 

Rejection of claims 3, 19, 36, 41, and 43 under 35 USG 103(a) as 1 
being unpatentable over Grupe in view of- Zuta. 



Group #1 Claims 3, 19, and 43 
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Appellant's argument that above claims have not been met by the 
prior art by virtue of the arguments made in Issue #2, Group #1 
above is moot in view of the above response. 

Group #1 Claim 36 

Appellant's argument that above claims have not been met by the 
prior art by virtue of the arguments made in Issue #2, Group #5 
above is moot in view of the above response. 

Group #3 Claim 41 ■ 

Appellant argues Zuta fails to disclose, "wherein the scanning 
control logic is executed automatically when a computer is 
booted." Zuta discloses on page 24, 

At power-up the controller 21 loads known viruses pattern as well 
as sensitive operation which demand further scrutiny, like 
interrupts or file operations or I/O. 

During normal operation thereafter, if a virus is detected then 
the monitoring means act promptly to stop the applications CPU 
through bus 247, to prevent damage. If a sensitive operation is 
detected in the monitoring unit, then the CPU is temporarily 
stopped and the controller 21 is prompted through bus 241 to 
perform a smart, in-depth analysis of the situation. 

Therefore, whpn the system is powered, up (i.e. booted up) the 
controller loads the necessary information to detect viruses and 
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since the monitoring means is detecting viruses thereafter 
during normal operation, the scanning logic must also be loaded 
at power-up. Furthermore, on page 6 Zuta discloses "2. 
controller means 21 to: initiate the monitoring means at start- 
up 7 ', this initiating is the scanning control logic automatically 
being executed since the monitoring means is hardware. 

Appellant argues' the Examiner fails to cite specific motivation 
in the above references to support the case for combining the 
same. In response to Appellant's argument that there is no 
suggestion to combine the references, the Examiner recognizes 
that obviousness can only be established by combining or 
modifying the teachings of the prior art to produce the claimed 
invention where there is some teaching, suggestion; or 
motivation to do so found either in the references themselves or 
in the knowledge generally available to one of ordinary skill in 
the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. 
Cir. 1988)and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. 
Cir. 1992) . Since a bus is a commonly used method of 
transmitting data between two units this is motivation known to 
one of ordinary skill in the art. 

Issue #4 
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Rejection of claim 37 under 35 USC 103(a) as being unpatentable 
over Grupe in view of Snavely. 

Group #1 Claim 37 

Appellant's argument that above claims have not been met by the 
prior art by virtue of the arguments made in Issue #2, Group #5 
above is moot in view of the above response. 
(11) Related Proceeding (s) Appendix 

No decision rendered by a court or the Board is identified 
by the examiner in the Related Appeals and Interferences section 
of this examiner's answer. 

For the above reasons, it is believed that the rejections 
should be sustained. 

Respectfully submitted, 
Michael Pyzocha 




